A newly disclosed WordPress security vulnerability dubbed “Click2Shell” could allow attackers to achieve remote code execution on vulnerable websites by tricking an administrator into visiting a specially crafted URL.
Technical details and a proof-of-concept exploit for the vulnerability have now been published. The flaw affects WordPress Core versions 7.1.0 and earlier and was addressed last week with the release of WordPress 7.1.1.
Security researcher Paulos Yibelo of penetration testing platform pwn.ai discovered the issue and reported it to WordPress on August 22. The vulnerability involves a cross-site request forgery (CSRF) flaw in the way WordPress handles theme previews.
According to the researchers, a value contained in a WordPress theme-preview URL is interpreted once by the WordPress.org Themes API and then handled incorrectly by JavaScript running in an administrator’s browser. This can allow an attacker to force a target website to install a theme from the official WordPress.org catalog without the administrator intentionally installing it.
The attack does not require the attacker to have a WordPress account, an installation nonce, or administrative privileges. However, the attack still requires a logged-in administrator to visit a specially crafted link.
Once the theme is installed, the attacker can use the WordPress Customizer preview to execute PHP code from the inactive theme. In its proof of concept, pwn.ai used a vulnerable theme as the second stage of the attack to achieve server-side remote code execution.
Successful exploitation could give an attacker the ability to modify or delete files, access website and user data, and read sensitive information stored in the wp-config.php file, including database credentials and authentication secrets. An attacker could potentially use that access to create unauthorized administrator accounts or inject malicious code into the website.
Although the researchers demonstrated the attack using a specific theme, the underlying WordPress Core vulnerability could be abused to force-install other vulnerable themes available through the WordPress.org catalog.
WordPress security company Patchstack also analyzed Click2Shell and noted that only administrators have the permissions required to complete the attack chain. Author and Editor accounts do not have the necessary permissions to install themes.
Patchstack warned that attackers could potentially deliver the malicious URL through targeted phishing or abuse an existing cross-site scripting vulnerability to make an administrator’s browser send the required request.
WordPress addressed the vulnerability in version 7.1.1 by escaping the theme slug before using it in the jQuery selector and restricting the selector to legitimate theme cards.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
Patchstack says websites with the DISALLOW_FILE_MODS setting enabled cannot be forced to install the theme or a malicious plugin through this attack. However, with technical details and a working proof of concept now publicly available, WordPress administrators should update to version 7.1.1 as soon as possible.
